move "USER build" to end of Dockerfile